Linked Questions

87 votes
10 answers
16k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
ataftoti's user avatar
  • 955
82 votes
10 answers
49k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
Mirco's user avatar
  • 923
78 votes
3 answers
17k views

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
GER's user avatar
  • 865
85 votes
4 answers
47k views

How to implement “forgot password” functionality?

For my project I need a "forgot password" functionality. I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
Stefan Falk's user avatar
  • 1,067
43 votes
10 answers
16k views

How can I securely check if a username exists?

I'm working on the onboarding functionality of my web app and at some point I'm asking a new user to choose a username. When the user gets to this point, I have his/her email and a cellphone number ...
frenchie's user avatar
  • 1,091
17 votes
5 answers
15k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
Gregor Petrin's user avatar
7 votes
7 answers
20k views

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
Traven's user avatar
  • 906
7 votes
4 answers
2k views

Adding "Email or Username" in login page, is it safe?

Let's suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site. Does that make it easy for an attacker to hack other people's account?
Naman's user avatar
  • 175
11 votes
5 answers
5k views

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
Justin's user avatar
  • 1,247
8 votes
2 answers
2k views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
BlueBerry - Vignesh4303's user avatar
4 votes
3 answers
1k views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
Jamie Little's user avatar
2 votes
5 answers
489 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
Kid Diamond's user avatar
0 votes
2 answers
3k views

Is it bad if one uses the same email address on different sites/forums?

Is it bad practice if one uses the same email address on different sites and forums?
steven's user avatar
  • 1
2 votes
1 answer
732 views

What are the disadvantages of logging someone in on register?

So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email? Let's presume that ...
xenoterracide's user avatar
2 votes
1 answer
805 views

How can I design a password reset function, which does not reduce security for users who can remember their password?

We have a web app for which some users want to have a password reset function. I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is ...
kasperd's user avatar
  • 5,472